SMS Home Routing

Can HLR Lookup tell if a mobile is roaming?

HLR lookup is often used to understand far more than whether a mobile number is active. Some businesses need to know a number’s roaming status because it can affect routing decisions, messaging costs, fraud controls, and how traffic is handled. 

For example, in some countries a carrier MUST perform a roaming check if they receive an inbound SMS or voice call on an international link from an MSISDN that uses a local telephone number prefix. If the subscriber is not roaming, then the carrier MUST not progress the call or SMS, as the originating phone number is suspected to be spoofed. However, roaming is one area where an HLR result needs real context.

If the home operator of the phone number that is being queried uses SMS Home Routing, the network information returned by an HLR lookup will mask whether the subscriber is roaming. If home routing is enabled, the HLR result will appear to point back to the subscriber’s home network even when they are roaming elsewhere. That does not mean the lookup is wrong; it means the operator has chosen not to expose the full routing path to the subscriber.

To understand why a network may do this, it helps to look at what happens when a network sends a subscriber an SMS message.

How SRI-SM normally helps identify the serving network

When an MT-SMS (Mobile Terminated SMS) is sent, the originating SMS infrastructure needs to know where to reach the destination subscriber. In a traditional GSM/UMTS flow, the SMS-GMSC sends a sendRoutingInfoForSM request, usually shortened to SRI-SM, to the recipient’s home network. The response can include information about the subscriber and the address of the Mobile Switching Centre (MSC) or SGSN currently serving them.

Here is an example flow:

Originating SMSC

↓

SMS-GMSC

↓

SRI-SM request

↓

Recipient HLR

↓

Subscriber information + serving MSC/SGSN

↓

SMS-GMSC

When the originating network's SMS infrastructure receives the HLR result, it can see which MSC or SGSN is currently handling messages for the subscriber and then forward the SMS directly to the MSC/SGSN for onward termination to the subscriber over the radio channel.

That serving-network information can help determine whether a subscriber appears to be roaming. If the serving node belongs to a network outside the subscriber’s home network, for example, it can strongly indicate that the subscriber is currently roaming. But that relies on the network returning the real serving information. SMS Home Routing changes that.

What happens with SMS Home Routing?

With Home Routing, the recipient’s home operator keeps more control over the inbound SMS path. Rather than giving the originating network the actual MSC or SGSN serving the subscriber, the home network can return its own SMS Router or another routing point within the HPLMN. The message returns through the home network first, and the home operator handles onward delivery. This makes the flow of HLR details like this:

Originating SMSC

↓

SMS-GMSC

↓

SRI-SM request

↓

Recipient HPLMN

↓

SMS Router address / substituted identity

↓

SMS-GMSC

The home network still has the information it needs to deliver the message. The difference, however, is that it does not necessarily share that information with the originating side. This is why roaming detection becomes less straightforward.

A home-network response does not always mean the subscriber is at home

Without Home Routing, the returned MSC or SGSN may give you visibility of the network currently serving the subscriber. With Home Routing, the response may instead point back to the subscriber’s home network. So a result that appears to say, "Home network," does not always mean the subscriber is not roaming. It may mean the home operator is handling the routing and keeping the actual serving network behind its own infrastructure. The subscriber could still be roaming on another network.

“Home Routing changes what you can see from an HLR response. The home network still knows where the message needs to go, but it may choose not to expose the network actually serving the subscriber. That’s where you need to be careful with roaming. A result pointing back to the home network doesn’t necessarily mean the subscriber is there; they could still be roaming elsewhere.” David Morris, CEO of Acudo, the company behind HLR Lookup.

For routing teams, CPaaS platforms, or applications that use roaming status for automated decision-making, the difference between a standard HLR response and a home-routed HLR response matters. The serving-network data needs to be read in the context of how the destination operator handles SMS routing.

Why do operators use Home Routing?

Operators don't do this to make HLR results difficult to interpret. Home Routing gives the home network more control over inbound MT-SMS and over the information it exposes to other networks. Instead of sending subscriber and serving-network details directly back to an external network, the operator can keep that information within its own environment. 

There are several reasons for doing this. It can help protect subscriber information, reduce exposure of network topology and support SMS firewalling and fraud controls. It also gives the home operator more control when subscribers roam, including areas such as charging and lawful interception. 

From the operator’s perspective, there are good reasons not to expose every detail of the subscriber’s current network attachment. From the perspective of someone consuming raw SS7 HLR data, however, it means some fields cannot always be taken literally.

The IMSI is replaced with a Correlation ID

Serving-network information is not the only thing that can be protected. In most Home Routing implementations, the home operator can also avoid exposing the subscriber’s real IMSI. Instead, it can return a correlation ID value that allows its SMS Router to associate the incoming message with the original request. The correlation ID is an ephemeral reference to the real subscriber's IMSI, and the same correlation ID may be used later for a different subscriber's IMSI after the initial timeout of the previous use. 

The correlation ID still looks like an IMSI, and includes the correct MCCMNC prefix inside the IMSI to allow for correct rating and routing to the home network. For most HLR Lookup users, this will not affect the basic decision they are trying to make, but it becomes important when raw network fields are being used further downstream. The same principle applies: the response may contain exactly what the network needs to handle the SMS without giving the requester a completely transparent view of what is happening behind it.

Can HLR Lookup tell if someone is roaming?

Not through hlrlookup.com. We took the decision many years ago to remove any IMSI or roaming information from HLR results returned by us. As more networks moved to Home Routing within their infrastructure, the flag to detect whether a subscriber is roaming became inaccurate. Networks do not publish whether they do or do not use Home Routing, and it is up to the queried network to make a business and technical decision to do this or not.

What this means when reading an HLR result

Home Routing removes confirmation from the result if a subscriber is roaming or not. Number status, home network information, portability status, number type, and reachability are unaffected and continue to provide the minimum required checks companies should perform to know whether a phone number is valid, active, and online.